**Quick answer:** Ransomware groups no longer just encrypt your files — they hunt down and disable your backups first, so you have no way to recover without paying. Recent research from Veeam and Sophos shows most attacked organizations still lose the majority of their data even when backups exist, because those backups weren’t isolated, immutable, or tested. For businesses, the fix isn’t buying more backup software — it’s rethinking how backups are stored, separated from everyday credentials, and verified.
Backups Have Become the First Target, Not the Last Resort
For years, the advice was simple: back up your data and ransomware loses its leverage. Attackers have adapted. Before they ever trigger encryption, many ransomware groups now spend days quietly mapping a network, elevating privileges, and specifically locating backup repositories, management consoles, and the credentials that control them.
The logic is straightforward from the attacker’s side: if a victim can restore quickly from a clean backup, there’s no reason to pay. So the backup itself becomes a target, not an afterthought.
Veeam’s "From Risk to Resilience: 2025 Ransomware Trends and Proactive Strategies" report, based on a survey of 1,300 IT and security leaders, found that nearly 70% of organizations experienced a cyberattack in the past year. More telling: only 10% of attacked organizations recovered more than 90% of their data afterward, and 57% recovered less than half. That gap between "we have backups" and "we actually got our data back" is where most businesses get hurt.
How a Modern Attack Actually Unfolds
A typical ransomware incident today doesn’t start with encryption — it starts with access. According to Sophos’s State of Ransomware 2026 report, a survey of 2,158 IT and cybersecurity leaders across 17 countries conducted in early 2026, identity compromise has overtaken software vulnerabilities as the leading way attackers get in, now driving roughly 79% of ransomware attacks. Once inside, the typical sequence looks like this:
- A compromised password, phished login, or exposed remote-access tool gives the attacker a foothold
- They move laterally and escalate privileges, often using legitimate admin tools to stay hidden
- They locate and disable or delete backup jobs, snapshots, and backup server access before anyone notices
- Only then do they deploy encryption — and in 2026, that effort succeeded in encrypting data in 56% of attacks, per Sophos
By the time most IT teams detect the attack, the safety net is already gone.
The Cost of Finding Out Too Late
The financial picture backs this up. Sophos puts the average ransomware recovery cost at $1.7 million and the median ransom demand at $769,000 — figures that dwarf what most small and mid-size businesses budget for a single incident. Even so, the ransom payment rate fell to 48% of organizations whose data was encrypted, the lowest in three years, largely because more businesses were able to restore from backups instead of paying. Veeam found that organizations that prioritize data resilience recover from attacks up to seven times faster than those that don’t. The difference isn’t luck — it’s architecture.
Building a Backup Strategy Ransomware Can’t Reach
Follow the 3-2-1-1-0 Rule
Veeam recommends evolving the classic 3-2-1 backup rule (three copies, two media types, one offsite) into **3-2-1-1-0**: three copies of your data, on two different media types, one copy offsite, one copy offline or immutable, and zero errors confirmed through recovery testing. The extra "1" and "0" are what actually stop a backup-aware attacker.
Make at Least One Copy Immutable or Offline
If a backup can be modified or deleted by someone with admin credentials, it can be modified or deleted by an attacker who steals those credentials. Immutable storage (where data can’t be altered or erased for a set retention window) and genuinely offline or air-gapped copies remove that risk entirely, even if the rest of your network is compromised.
Separate Backup Credentials From Everyday Admin Access
Since identity compromise is now the leading entry point, the accounts that control your backup system shouldn’t share passwords, permissions, or multi-factor setups with everyday IT administration. A separate, tightly restricted identity for backup management means a phished help-desk credential doesn’t automatically hand over the keys to your recovery plan.
Test Restores, Not Just Backups
A backup job completing successfully tells you nothing about whether you can actually recover a working system from it. Regularly test full restores — not just file-level recovery — against a realistic scenario, and track how long it actually takes. CISA’s #StopRansomware guidance is blunt about this: "maintain offline, encrypted backups of data and regularly test your backups."
What This Means for Businesses
businesses don’t need enterprise security budgets to apply these principles, but they do need a backup setup that assumes an attacker might already be inside before anyone notices. A few questions worth asking this quarter:
- Does at least one backup copy sit somewhere an admin credential alone can’t reach or delete it?
- Who has access to the backup console, and is that access separate from daily IT administration?
- When was the last time anyone actually restored a system from backup — not just checked that a job ran?
- If identity is now the top attack vector, is multi-factor authentication enforced everywhere backup and admin systems are managed?
Ransomware groups have gotten better at finding and disabling the safety net before anyone knows it’s gone. A backup strategy built for 2026 has to assume that’s the plan — and be designed so it doesn’t work.
Sources
This article draws on original survey research from Veeam and Sophos, along with federal guidance from CISA. Figures cited (attack rates, recovery percentages, ransom and recovery costs) reflect the specific survey periods and methodologies described in each source — see the linked reports for full details.
